Throw when a holey property is set in Array.sort

src/js/array.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils, extrasUtils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
@@ skipping 953 matching lines @@
     // the prototype chain on non-Array objects.
     // We do this by copying them to this object and sorting only
     // own elements. This is not very efficient, but sorting with
     // inherited elements happens very, very rarely, if at all.
     // The specification allows "implementation dependent" behavior
     // if an element on the prototype chain has an element that
     // might interact with sorting.
     max_prototype_element = CopyFromPrototype(array, length);
   }
 
+  if (!%object_is_extensible(array)) {
+    // If the array have holes in the middle of the array,
+    // hole indices can be defined while removing array holes.
+    var last_hole = -1;
+    var first_hole = -1;
+    for (var i = 0; i < length; i++) {
+      if (!HAS_OWN_PROPERTY(array, i)) {
+        if (first_hole == -1) first_hole = i;
+        last_hole = i;
+      }
+    }
+    if (last_hole != -1 && last_hole < length - 1) {
+      throw %make_type_error(kObjectNotExtensible, first_hole);
+    }
+  }
+
   // %RemoveArrayHoles returns -1 if fast removal is not supported.
   var num_non_undefined = %RemoveArrayHoles(array, length);
 
   if (num_non_undefined == -1) {
     // There were indexed accessors in the array.
     // Move array holes and undefineds to the end using a Javascript function
     // that is safe in the presence of accessors.
     num_non_undefined = SafeRemoveArrayHoles(array);
   }
 
@@ skipping 650 matching lines @@
   "array_pop", ArrayPop,
   "array_push", ArrayPush,
   "array_shift", ArrayShift,
   "array_splice", ArraySplice,
   "array_slice", ArraySlice,
   "array_unshift", ArrayUnshift,
   "array_values_iterator", ArrayValues,
 ]);
 
 });